Then i'm not sure what the solution is.

I would say that we can have different devices for different peoples' needs; I personally want the ability to purchase a device with an absolutely locked-down state where no unauthorized or unaudited code can be ran, and currently iOS gets pretty close to that for me. But that is being taken away by laws like the EU's new sideloading law. Even if, after this is passed, I go out and make my own phone that serves my interests, I am forced to limit how many I sell if I want to keep it operational.

> I personally want the ability to purchase a device with an absolutely locked-down state where no unauthorized or unaudited code can be ran, and currently iOS gets pretty close to that for me.

No one is forcing you to run any "unauthorised" code. What you suggest is that, because you don't want to side load stuff, no one should be allowed to? Doesn't make much sense to me, to be honest.

My threat model is an evil maid attack, ie. someone watches over your shoulder as you enter your passcode, then steals your phone from your hotel room and sideloads malware (that hides the fact that it's been sideloaded).

I'm sure it's possible on Android to install enterprise management or MAM solution that locks down side-loading, locked behind some custom password (not the regular password that the maid would see)